linux-kernel - Re: [PATCH] x86/kexec: Disable global pages before writing to control page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <05d802b7-4491-4296-9e4f-223e9fdbae95@linux.intel.com>
Date: Fri, 13 Dec 2024 15:51:29 +0800
From: "Ning, Hongyu" <hongyu.ning@...ux.intel.com>
To: David Woodhouse <dwmw2@...radead.org>, Dave Hansen
 <dave.hansen@...el.com>, Nathan Chancellor <nathan@...nel.org>
Cc: kexec@...ts.infradead.org, Thomas Gleixner <tglx@...utronix.de>,
 Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
 Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org,
 "H. Peter Anvin" <hpa@...or.com>,
 "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
 Kai Huang <kai.huang@...el.com>, Nikolay Borisov <nik.borisov@...e.com>,
 linux-kernel@...r.kernel.org, Simon Horman <horms@...nel.org>,
 Dave Young <dyoung@...hat.com>, Peter Zijlstra <peterz@...radead.org>,
 jpoimboe@...nel.org, bsz@...zon.de
Subject: Re: [PATCH] x86/kexec: Disable global pages before writing to control
 page



On 2024/12/13 7:08, David Woodhouse wrote:
> From: David Woodhouse <dwmw@...zon.co.uk>
> 
> The kernel switches to a new set of page tables during kexec. The global
> mappings (_PAGE_GLOBAL==1) can remain in the TLB after this switch. This
> is generally not a problem because the new page tables use a different
> portion of the virtual address space than the normal kernel mappings.
> 
> The critical exception to that generalisation (and the only mapping
> which isn't an identity mapping) is the kexec control page itself —
> which was ROX in the original kernel mapping, but should be RWX in the
> new page tables. If there is a global TLB entry for that in its prior
> read-only state, it definitely needs to be flushed before attempting to
> write through that virtual mapping.
> 
> It would be possible to just avoid writing to the virtual address of the
> page and defer all writes until they can be done through the identity
> mapping. But there's no good reason to keep the old TLB entries around,
> as they can cause nothing but trouble.
> 
> Clear the PGE bit in %cr4 early, before storing data in the control page.
> 
> Fixes: 5a82223e0743 ("x86/kexec: Mark relocate_kernel page as ROX instead of RWX")
> Co-authored-by: Dave Hansen <dave.hansen@...ux.intel.com>
> Reported-by: Nathan Chancellor <nathan@...nel.org>
> Reported-by: "Ning, Hongyu" <hongyu.ning@...ux.intel.com>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219592
> Signed-off-by: Dave Hansen <dave.hansen@...ux.intel.com>
> Signed-off-by: David Woodhouse <dwmw@...zon.co.uk>
> Tested-by: Nathan Chancellor <nathan@...nel.org>

Tested-by: "Ning, Hongyu" <hongyu.ning@...ux.intel.com>

> ---
> This supersedes the previous 'Only write through identity mapping of
> control page' patch as Dave's approach is much saner now he's actually
> figured out what's going on.
> 
> 
>   arch/x86/kernel/relocate_kernel_64.S | 12 +++++++++---
>   1 file changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
> index 553d67845b84..cbadf0142fcb 100644
> --- a/arch/x86/kernel/relocate_kernel_64.S
> +++ b/arch/x86/kernel/relocate_kernel_64.S
> @@ -90,14 +90,20 @@ SYM_CODE_START_NOALIGN(relocate_kernel)
>   	movq	kexec_pa_table_page(%rip), %r9
>   	movq	%r9, %cr3
>   
> +	/* Leave CR4 in %r13 to enable the right paging mode later. */
> +	movq	%cr4, %r13
> +
> +	/* Disable global pages immediately to ensure this mapping is RWX */
> +	movq	%r13, %r12
> +	andq	$~(X86_CR4_PGE), %r12
> +	movq	%r12, %cr4
> +
>   	/* Save %rsp and CRs. */
> +	movq	%r13, saved_cr4(%rip)
>   	movq    %rsp, saved_rsp(%rip)
>   	movq	%rax, saved_cr3(%rip)
>   	movq	%cr0, %rax
>   	movq	%rax, saved_cr0(%rip)
> -	/* Leave CR4 in %r13 to enable the right paging mode later. */
> -	movq	%cr4, %r13
> -	movq	%r13, saved_cr4(%rip)
>   
>   	/* save indirection list for jumping back */
>   	movq	%rdi, pa_backup_pages_map(%rip)